Malware hides in Steam comments to infect WordPress sites

Nearly 2,000 WordPress websites have been infected with malware that uses Steam Community profile comments to conceal command-and-control data. This tactic allows attackers to avoid maintaining separate infrastructure and evade detection methods, according to a recent report by Bleeping Computer.

The malware campaign, discovered in July 2025, has affected approximately 1,980 WordPress sites. Researchers from GoDaddy suspect initial infection vectors include compromised login credentials, vulnerable themes or plugins, or supply-chain attacks. The first-stage malware extracts encoded payloads from seemingly benign comments on Steam profiles, utilizing invisible Unicode characters to hide malicious scripts. These characters are decoded into binary data, which then constructs a URL pointing to a malicious JavaScript file disguised as a legitimate library. This script is injected into WordPress pages, ultimately installing a backdoor.

The backdoor responds to specific POST requests with an authentication cookie, allowing it to receive base64-encoded PHP code. The malware employs evasion techniques like obfuscated strings and randomized function names. Site owners can defend against this threat by checking for Steam Community URLs, suspicious JavaScript injections, and outbound connections to hello-mywordl[.]info, among other indicators. Restoring from a known good backup is the recommended remediation, as manual cleaning requires thoroughness to prevent reinfection through the backdoor.

Source: Bleeping Computer